LazyRequest: enforce channel visibility and configurable member listing

[devin-ai-integration]

Scope

• Only show roles/members with access to the requested channel
• Provide config to list all members sorted by role vs. only online members
• Exclude TypeORM migration work; reference the existing issue for ORM

Acceptance criteria

• Visibility checks block roles/members lacking VIEW_CHANNEL on the target channel
• Configurable member listing behavior implemented and documented

Code references

• TODOs: https://github.com/erkinalp/anticensor/blob/master/src/gateway/opcodes/LazyRequest.ts#L43-L46

Related

• Migrate away from TypeORM: Migrate away from TypeORM #32

[traycerai]

Plan

Observations

I've analyzed the LazyRequest implementation and found that it currently fetches all guild members without filtering by channel visibility. The code has TODOs for enforcing channel visibility and adding configurable member listing. The permission system is well-established with getPermission() and Permissions.finalPermission() functions. The config system uses Config.get() pattern and is structured with nested configuration objects.

Approach

The implementation will add channel visibility filtering by checking each member's VIEW_CHANNEL permission for the requested channel, and introduce a configurable option to control whether offline members are included. I'll extend the guild configuration with a new memberList section, refactor the existing getMembers function to accept filtering parameters, and implement post-query filtering using the existing permission system to maintain simplicity and avoid complex SQL modifications.

Reasoning

I explored the codebase structure and identified the LazyRequest implementation in src/gateway/opcodes/LazyRequest.ts. I examined the permission system in src/util/util/Permissions.ts, the configuration system in src/util/config/, and the Member/Channel entities to understand data relationships. I found examples of how Config.get() is used and how VIEW_CHANNEL permissions are checked throughout the codebase.

Proposed File Changes

📄 src/util/config/types/subconfigurations/guild/MemberListConfiguration.ts ^(NEW) 🔗

Create a new configuration class for member list settings. Define MemberListConfiguration class with a single property includeOffline defaulting to true. This controls whether offline members should be included in lazy request responses. Add proper TypeScript typing and export the class for use in the main guild configuration.

📄 src/util/config/types/subconfigurations/guild/index.ts ^(MODIFY) 🔗

References

• 📄 src/util/config/types/subconfigurations/client/index.ts

Create an index file to export the MemberListConfiguration class. This follows the existing pattern used in other subconfiguration directories like src/util/config/types/subconfigurations/client/index.ts.

📄 src/util/config/types/GuildConfiguration.ts ^(MODIFY) 🔗

References

• 📄 src/util/config/types/subconfigurations/guild/MemberListConfiguration.ts ^(NEW)

Import the new MemberListConfiguration from the subconfigurations directory. Add a new property memberList of type MemberListConfiguration with default initialization new MemberListConfiguration(). This extends the existing guild configuration to include member list behavior settings.

📄 src/gateway/opcodes/LazyRequest.ts ^(MODIFY) 🔗

References

• 📄 src/util/entities/Member.ts
• 📄 src/util/util/Permissions.ts

Import Config from @spacebar/util following the pattern used in src/util/entities/Member.ts. Refactor the getMembers function to getMembersFiltered that accepts additional parameters: channel: Channel and includeOffline: boolean.

Implement member filtering logic after the existing database query but before building the response structure:

1. For each member in the results, use Permissions.finalPermission() to check if they have VIEW_CHANNEL permission for the target channel
2. Filter out members who don't have this permission
3. When includeOffline is false, skip adding the offline items group and members to the response

Update the onLazyRequest function to:

1. Read the configuration value using Config.get().guild.memberList.includeOffline
2. Pass the already-loaded channel object and includeOffline flag to the new getMembersFiltered function
3. Update the TODO comments to reflect the completed implementation

The role filtering will happen automatically since member_roles is rebuilt from the filtered member list, ensuring only roles from visible members are included.

Diagram

sequenceDiagram
    participant Client
    participant Gateway as Gateway/LazyRequest
    participant Config
    participant DB as Database
    participant Permissions as Permission System

    Client->>Gateway: LAZY_REQUEST with channel_id
    Gateway->>Config: get().guild.memberList.includeOffline
    Config-->>Gateway: boolean flag
    Gateway->>DB: Query members with roles/sessions
    DB-->>Gateway: Raw member list
    
    loop For each member
        Gateway->>Permissions: finalPermission(member, channel)
        Permissions-->>Gateway: Permission object
        Gateway->>Gateway: Check has("VIEW_CHANNEL")
        alt Has VIEW_CHANNEL
            Gateway->>Gateway: Keep member
        else No VIEW_CHANNEL
            Gateway->>Gateway: Filter out member
        end
    end
    
    alt includeOffline = false
        Gateway->>Gateway: Remove offline group & members
    end
    
    Gateway->>Gateway: Build groups from filtered members
    Gateway->>Client: GUILD_MEMBER_LIST_UPDATE (filtered)

Loading

Import In IDE

🤖 Prompt for AI Agents

I have created the following plan after thorough exploration and analysis of the codebase. Follow the below plan verbatim. Trust the files and references. Do not re-verify what's written in the plan. Explore only when absolutely necessary. First implement all the proposed file changes and then I'll review all the changes together at the end.

### Observations

I've analyzed the LazyRequest implementation and found that it currently fetches all guild members without filtering by channel visibility. The code has TODOs for enforcing channel visibility and adding configurable member listing. The permission system is well-established with `getPermission()` and `Permissions.finalPermission()` functions. The config system uses `Config.get()` pattern and is structured with nested configuration objects.

### Approach

The implementation will add channel visibility filtering by checking each member's `VIEW_CHANNEL` permission for the requested channel, and introduce a configurable option to control whether offline members are included. I'll extend the guild configuration with a new `memberList` section, refactor the existing `getMembers` function to accept filtering parameters, and implement post-query filtering using the existing permission system to maintain simplicity and avoid complex SQL modifications.

### Reasoning

I explored the codebase structure and identified the LazyRequest implementation in `src/gateway/opcodes/LazyRequest.ts`. I examined the permission system in `src/util/util/Permissions.ts`, the configuration system in `src/util/config/`, and the Member/Channel entities to understand data relationships. I found examples of how `Config.get()` is used and how `VIEW_CHANNEL` permissions are checked throughout the codebase.

## Mermaid Diagram

sequenceDiagram
    participant Client
    participant Gateway as Gateway/LazyRequest
    participant Config
    participant DB as Database
    participant Permissions as Permission System

    Client->>Gateway: LAZY_REQUEST with channel_id
    Gateway->>Config: get().guild.memberList.includeOffline
    Config-->>Gateway: boolean flag
    Gateway->>DB: Query members with roles/sessions
    DB-->>Gateway: Raw member list
    
    loop For each member
        Gateway->>Permissions: finalPermission(member, channel)
        Permissions-->>Gateway: Permission object
        Gateway->>Gateway: Check has("VIEW_CHANNEL")
        alt Has VIEW_CHANNEL
            Gateway->>Gateway: Keep member
        else No VIEW_CHANNEL
            Gateway->>Gateway: Filter out member
        end
    end
    
    alt includeOffline = false
        Gateway->>Gateway: Remove offline group & members
    end
    
    Gateway->>Gateway: Build groups from filtered members
    Gateway->>Client: GUILD_MEMBER_LIST_UPDATE (filtered)

## Proposed File Changes

### src/util/config/types/subconfigurations/guild/MemberListConfiguration.ts(NEW)

Create a new configuration class for member list settings. Define `MemberListConfiguration` class with a single property `includeOffline` defaulting to `true`. This controls whether offline members should be included in lazy request responses. Add proper TypeScript typing and export the class for use in the main guild configuration.

### src/util/config/types/subconfigurations/guild/index.ts(MODIFY)

References: 

- src/util/config/types/subconfigurations/client/index.ts

Create an index file to export the `MemberListConfiguration` class. This follows the existing pattern used in other subconfiguration directories like `src/util/config/types/subconfigurations/client/index.ts`.

### src/util/config/types/GuildConfiguration.ts(MODIFY)

References: 

- src/util/config/types/subconfigurations/guild/MemberListConfiguration.ts(NEW)

Import the new `MemberListConfiguration` from the subconfigurations directory. Add a new property `memberList` of type `MemberListConfiguration` with default initialization `new MemberListConfiguration()`. This extends the existing guild configuration to include member list behavior settings.

### src/gateway/opcodes/LazyRequest.ts(MODIFY)

References: 

- src/util/entities/Member.ts
- src/util/util/Permissions.ts

Import `Config` from `@spacebar/util` following the pattern used in `src/util/entities/Member.ts`. Refactor the `getMembers` function to `getMembersFiltered` that accepts additional parameters: `channel: Channel` and `includeOffline: boolean`. 

Implement member filtering logic after the existing database query but before building the response structure:
1. For each member in the results, use `Permissions.finalPermission()` to check if they have `VIEW_CHANNEL` permission for the target channel
2. Filter out members who don't have this permission
3. When `includeOffline` is false, skip adding the offline items group and members to the response

Update the `onLazyRequest` function to:
1. Read the configuration value using `Config.get().guild.memberList.includeOffline`
2. Pass the already-loaded `channel` object and `includeOffline` flag to the new `getMembersFiltered` function
3. Update the TODO comments to reflect the completed implementation

The role filtering will happen automatically since `member_roles` is rebuilt from the filtered member list, ensuring only roles from visible members are included.

---

Developer Humor

> Why did the Discord member get filtered out?\n> Because they couldn't VIEW_CHANNEL their way in! 👀\n> \n> ┌─────────────┐\n> │ ✅ Visible │\n> │ ❌ Hidden │\n> │ ⚙️ Config │\n> └─────────────┘\n> \n> Now your lazy requests are working overtime! 🚀\

---

Execution Information

Branch: master
Commit: 0442d70

---

💡 Tips

Supported Commands (Inside Comments)

• Use @traycerai generate to iterate on the previous version of the implementation plan.

Supported Commands (Inside Description)

• Add @traycerai ignore anywhere in the ticket description to prevent this ticket from being processed.
• Add @traycerai branch:<branch-name> anywhere in the ticket description to specify the target branch for the implementation plan.

Community

• Join our Discord Community to get help, request features, and share feedback.
• Follow us on X/Twitter for updates and announcements.